364M Users Exposed to CVE-2026-90711: 9.1 CVSS proxy-addr IP Spoofing Flaw

Security researchers have disclosed a severe proxy-addr IP spoofing flaw affecting popular Node.js applications. This misconfiguration vulnerability, tracked as CVE-2026-90711, allows unauthenticated users to bypass critical network controls by spoofing their client IP addresses. Developers must update the package immediately to secure rate limiting and access controls.

Why This Threat Matters

The proxy-addr module operates inside thousands of Node.js servers, including popular web frameworks like Express. Industry estimates show developers download this npm package over 364 million times every month. Therefore, vulnerabilities within this specific module threaten massive portions of the modern web. If attackers successfully forge their IP addresses, they can bypass network access control lists. Furthermore, they can defeat rate limiting, bypass geolocation restrictions, and corrupt security audit logs.

How the Attack Works

This proxy-addr IP spoofing flaw occurs when administrators configure trust subnets using IPv4-mapped IPv6 addresses with short prefixes. The advisory explains, “When an application configures a trust subnet as an IPv4-mapped IPv6 address with a short prefix… the subnet compiles with all-zero leading bits and matches every IPv4 address instead of the block it names.”

Consequently, the application compiles the misconfigured subnet without returning any errors. Because the rule matches every incoming IPv4 address, the application blindly trusts every client as a valid proxy. The server then extracts the client’s IP from the unverified X-Forwarded-For HTTP header. As a result, unauthenticated clients can inject arbitrary IP addresses into the application logic. Currently, security teams have confirmed no active in-the-wild exploitation. Likewise, no public proof-of-concept code exists for this vulnerability.

Affected Versions

This critical vulnerability affects all proxy-addr versions prior to 2.0.8.

Patch and Mitigation Steps

Developers must upgrade immediately to proxy-addr version 2.0.8. The updated version correctly restricts IPv4 matches to genuine IPv4-mapped subnets. If upgrading is temporarily impossible, administrators should write IPv4 trust subnets strictly in plain IPv4 notation.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.